CVE-2026-78395 Link Library < 7.10.0 - Unauthenticated Link Submission Login Requirement Bypass

The Link Library WordPress plugin before 7.10.0 does not re-check the selected library's own login requirement when processing its front-end link submission, allowing unauthenticated users to submit links to a library configured to require login by reusing a form token obtained from another libra...

EUVD-2026-112609

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two administrator-only actions that bulk-delete captured form submissions and wipe a form's statistics, allowing attackers to permanently destroy a site's stored contact leads and...

EUVD-2026-112613

The Link Library WordPress plugin before 7.10.0 does not verify that a requested link belongs to the settings set whose display template is used to render it, allowing unauthenticated users to disclose the telephone number, e-mail address and submitter name stored with links that the settings set...

CVE-2026-78395

The Link Library WordPress plugin (versions before 7.10.0 ) is vulnerable to an unauthenticated link submission login requirement bypass . The root cause is that the plugin fails to re-verify the specific login requirements of a selected library during front-end link submission. This allows unaut...

CVE-2026-78396

The Link Library WordPress plugin, in versions prior to 7.10.0 , is vulnerable to unauthenticated information disclosure. The root cause is a lack of verification that a requested link belongs to the specific settings set used for the display template. This allows attackers to access and disclose...

EUVD-2026-112611

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not restrict access to an AJAX action that deletes stored form statistics records, allowing unauthenticated attackers to delete arbitrary statistics entries...

CVE-2026-115300

The Contact Form by Supsystic WordPress plugin, in versions before 1.11.1 , is vulnerable to Cross-Site Request Forgery (CSRF) . The application fails to validate CSRF tokens or request origins on two specific administrator-only actions: bulk-deleting captured form submissions and wiping form sta...

EUVD-2026-112612

The Link Library WordPress plugin before 7.10.0 does not re-check the selected library's own login requirement when processing its front-end link submission, allowing unauthenticated users to submit links to a library configured to require login by reusing a form token obtained from another libra...

EUVD-2026-112610

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not sandbox the template engine used to render its forms and allows stored form-editor content to reach that engine as executable template code, enabling an administrator to perform server-side template injection and execute...

WordPress Contact Form by Supsystic plugin < 1.11.1 - Arbitrary Plugin Settings Update vulnerability

Arbitrary Plugin Settings Update vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Contact Form by Supsystic versions 1.11.1...

EUVD-2026-112608

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not verify a CSRF nonce before saving its mail settings, allowing an attacker to overwrite the site's outbound mail configuration, including the SMTP server, its credentials and the notification recipient, by tricking a logged-in...

CVE-2026-115299 Contact Form by Supsystic < 1.11.1 - Arbitrary Plugin Settings Update via CSRF

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not verify a CSRF nonce before saving its mail settings, allowing an attacker to overwrite the site's outbound mail configuration, including the SMTP server, its credentials and the notification recipient, by tricking a logged-in...

CVE-2026-115282 Recipe Card Blocks Lite 2.6.4 - 3.6.3 - Unauthenticated Unpublished Post Content Disclosure

The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not perform an authorization check before rendering posts through its recipe print feature, allowing unauthenticated users to disclose the title, ID and recipe content of unpublished posts, including drafts, pending, private and...

CVE-2026-115299

The Contact Form by Supsystic WordPress plugin, in versions prior to 1.11.1 , is vulnerable to a Cross-Site Request Forgery (CSRF) flaw. The issue arises because the plugin fails to verify a CSRF nonce when saving mail settings. A remote attacker can exploit this by tricking a logged-in administr...

EUVD-2026-112607

The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not perform an authorization check before rendering posts through its recipe print feature, allowing unauthenticated users to disclose the title, ID and recipe content of unpublished posts, including drafts, pending, private and...

CVE-2026-115282

The Recipe Card Blocks Lite WordPress plugin (versions 2.6.4-3.6.3 ) is vulnerable to an unauthenticated unpublished post content disclosure due to a missing authorization check. The flaw exists within the recipe print feature , which allows attackers to view the title, ID, and content of unpubli...

CVE-2025-3102

CVE-2025-3102 🛠️ SureTriggers Exploit Script This script is used to identify and exploit security vulnerabilities in the SureTriggers plugin on WordPress sites using a vulnerable version ≤ v1.0.78. If successful, the script will automatically create a WordPress admin account. ⚙️ Features Detection...

CVE-2025-22785

CVE-2025-22785 Course Booking System = 6.0.5 - Unauthenticated SQL Injection Description The Course Booking System plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 6.0.5 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2023-4800

CVE ID: CVE-2023-4800 Vulnerability Type: Sensitive Data Exposure Description: The DoLogin Security plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the dashboard widget in versions up to, and including, 3.7. This makes it possible for...

CVE-2024-9822

CVE-2024-9822 Pedalo Connector = 2.0.5 - Authentication Bypass to Administrator Description The Pedalo Connector plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.5. This is due to insufficient restriction on the 'loginadminuser' function. This make...